maride/guacamole-spice-protocol
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

GUACAMOLE-1669: Include ext-info-c in preferred KEX algorithms to ensure RSA key upgrades can happen.

Browse Source
This commit is contained in:
James Muehlner 2022-09-13 21:39:38 +00:00
parent 4d211e0c9e
commit b096e47f57
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/common-ssh/ssh.c
View File

@ -49,9 +49,12 @@ GCRY_THREAD_OPTION_PTHREAD_IMPL;
/** /**
* A list of all key exchange algorithms that are both FIPS-compliant, and * A list of all key exchange algorithms that are both FIPS-compliant, and
* OpenSSL-supported. * OpenSSL-supported. Note that "ext-info-c" is also included. While not a key
* exchange algorithm per se, it must be in the list to ensure that the server
* will send a SSH_MSG_EXT_INFO response, which is required to perform RSA key
* upgrades.
*/ */
#define FIPS_COMPLIANT_KEX_ALGORITHMS "diffie-hellman-group-exchange-sha256" #define FIPS_COMPLIANT_KEX_ALGORITHMS "diffie-hellman-group-exchange-sha256,ext-info-c"
/** /**
* A list of ciphers that are both FIPS-compliant, and OpenSSL-supported. * A list of ciphers that are both FIPS-compliant, and OpenSSL-supported.